Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part headers incorrectly. When a multipart header contains an obs-fold sequence, Rack preserves the embedded CRLF in parsed parameter values such as filename or name instead of removing the folded line break during unfolding. As a result, applications that later reuse those parsed values in HTTP response headers may be vulnerable to downstream header injection or response splitting. This issue has been patched in version 3.2.6.
2.1.4-32.1.4-42.1.4-52.1.4-5ubuntu12.1.4-5ubuntu1.12.1.4-5ubuntu1.22.2.4-32.2.7-12.2.7-1ubuntu0.12.2.7-1ubuntu0.22.2.7-1ubuntu0.32.2.7-1ubuntu0.42.2.7-1ubuntu0.52.2.7-1ubuntu0.62.2.7-1ubuntu0.72.2.7-1.13.1.16-0.13.1.16-0.1ubuntu0.13.1.16-0.1ubuntu0.23.1.16-0.1ubuntu0.31.5.2-11.5.2-1ubuntu0.1~esm11.5.2-3+deb8u3ubuntu1~esm101.5.2-3+deb8u3ubuntu1~esm111.5.2-3+deb8u3ubuntu1~esm21.5.2-3+deb8u3ubuntu1~esm31.5.2-3+deb8u3ubuntu1~esm41.5.2-3+deb8u3ubuntu1~esm61.5.2-3+deb8u3ubuntu1~esm71.5.2-3+deb8u3ubuntu1~esm8+1 more1.5.2-41.6.4-21.6.4-31.6.4-3ubuntu0.11.6.4-3ubuntu0.21.6.4-3ubuntu0.2+esm11.6.4-3ubuntu0.2+esm101.6.4-3ubuntu0.2+esm21.6.4-3ubuntu0.2+esm41.6.4-3ubuntu0.2+esm5+4 more1.6.4-41.6.4-4ubuntu0.11.6.4-4ubuntu0.21.6.4-4ubuntu0.2+esm11.6.4-4ubuntu0.2+esm101.6.4-4ubuntu0.2+esm21.6.4-4ubuntu0.2+esm41.6.4-4ubuntu0.2+esm51.6.4-4ubuntu0.2+esm61.6.4-4ubuntu0.2+esm7+2 more2.0.6-32.0.7-22.0.7-2ubuntu0.12.0.7-2ubuntu0.1+esm12.0.7-2ubuntu0.1+esm102.0.7-2ubuntu0.1+esm22.0.7-2ubuntu0.1+esm32.0.7-2ubuntu0.1+esm42.0.7-2ubuntu0.1+esm52.0.7-2ubuntu0.1+esm6+3 moreExploitability
AV:NAC:HPR:NUI:NScope
S:UImpact
C:LI:LA:NCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N